PrestaShop and EU law-GPSR, GDPR, cookies and “opt out of agreement here”

A store on the European collision course?

On December 13, 2024, the GPSR entered into force, on June 28, 2025. The EAA comes into effect, and on June 19, 2026, the “cancel contract here” button should be visible in every store. Penalties for violating the GDPR? Up to 20 million euros or 4% of global turnover, whichever is higher. It sounds threatening because it’s threatening.

GPSR data is required outside your store too: TikTok Shop rejects listings without a manufacturer and an EU responsible person. The PrestaShop TikTok Shop module fetches this data from Seller Center and attaches it to every exported product.

Why exactly is PrestaShop feeling the pressure

PrestaShop is a European CMS that was born sometime between 2005 and 2007 (depending on when we expect it to start), and is popular mainly in the EU. As regulations tighten around e-commerce, stores on this platform are in the spotlight. In 2026, PrestaShop moved under the wing of cyberFolks.pl which opens up a new chapter, but one thing doesn’t change: legality is not a one-time installation of a module and “git”. This is a continuous process. Rules evolve, interpretations change, and modules are just tools, not a solution in itself.

What does this mean for the store owner? What you need to know, what’s going on, what responsibilities are waiting for you, and how to celebrate them without panicking. This article combines dry recipes with PrestaShop practices. I’ll show you specific requirements, point out tools, and tell you what you should have on your radar so that your store doesn’t run into regulatory problems.

EU Regulation Map for e-commerce on PrestaShop

PrestaShop store owners in the EU must juggle a significant set of rules today. Some of them have already been operating for years, others have appeared recently, and others are just around the corner. And everywhere the same abbreviations: GDPR, GPSR, DSA… Good news? PrestaShop as a popular platform in the EU (especially in Poland, France, Spain) has an extensive ecosystem of compliance modules on addons.prestashop.com so you’re not alone.

Schedule of key rules

valid context: The GDPR and GPSR apply extraterritorially. If you sell in the EU, you must have a responsible operator / importer in the Union, even if your business is, for example, in the UK or USA.

Co each act changes

the GDPR in the store – these are the rights of customers (data access, deletion, objection) plus the basics of processing, that is, you must know why you register. something Cookies and ePrivacy require consent against any tracking (Google Analytics, Facebook Pixel). Consumer Rights / Omnibus they give the customer 14 days to terminate the contract and order them to show the lowest price in the last 30 days for promotions. GPSR requires manufacturer / importer data on product cards plus a quick response for dangerous goods. EAA means WCAG 2.1 AA, i.e. accessibility for people with disabilities (contrast, navigation keyboard). VAT OSS simplifies VAT for cross-border sales, but you must report. the DSA imposes informational obligations on the platform(this applies moreto the marketplace).

The following sections will show you specific tools and deployments for each area.

GDPR and cookies in PrestaShop practice

PrestaShop requires the store owner to take fairly specific actions so as not to conflict with the GDPR. We are talking about tools, mechanisms and all this consent documentation that needs to be registered. Good news? There is an official module for this purpose.

Official GDPR Module:The

psgdpr (Official GDPR Compliance by PrestaShop) module has been working since 2018 and supports the rights of data subjects:

• requests for access to personal data,
• export of data in CSV or PDF format (portability),
• deletion of the account and related information,
• logs of all processing operations with timestamps,
• hooks for external modules that store data.

The module also allows you to document the legal basis of processing. In practice, this means: consent registers, IP addresses, dates and times, in accordance with the principle of data minimization.

Cookie consent and Consent Mode V2

the cookie banner is not just a pop-up “click OK” window. Consent must be informed, granular, and as easy to revoke as it is to provide. Tracking scripts (Google Analytics, Facebook Pixel) cannot be run until the user gives their consent.

PrestaShop works with Google’s Consent Mode v2, which maps user choices to specific advertising and analytics tags. It is important that the panel allows you to change your consent at any time.

Most common errors and risk of penalties

frequent crashes:

• by default, the check boxes are checked (consent must be active),
• there is no “reject all” button or hide it deep in the settings,
• and there is no easy access to reconfigure consent.

Penalties for violating the GDPR?

up to € 20 million or 4% of global turnover

All you need is one complaint to UODO and an audit that will show the lack of logs or the wrong banner. The risk is real, so it’s better to figure it out right away.

“Cancel contract here” button-step-by-step implementation

Starting from June 19, 2026, every online store in the EU must provide the “cancel contract here” function directly in the store’s interface. Directive 2023/2673 requires the button to be visible and permanently accessible, and the label to read exactly:

“cancel contract here”

. you can also use an equivalent formulation, but this works best. Don’t complicate it.

Cancellation process: two steps + email

The minimum path is a two-step process. Step one: the customer clicks the button and initiates a rejection (for example, selects an order, selects products). Step two: Confirm your intent to avoid accidental clicks. After approval, you must send a confirmation in a permanent medium, that is, just an email with the date of submission and the case number.

Important: The message on the screen is not enough. E-mail wymóg.

Co except for and where to place it

some products are non-refundable:

• personalized (prints, engraving)
• hygienic after unpacking (underwear, cosmetics)
• perishable items (food, flowers)

You should inform ex ante about exceptions, preferably in the product profile and in regulaminie.

Co location: Place the button in the customer’s account (My Orders section), optionally in the footer or order summary. The “EU Right of Withdrawal Button” module for PrestaShop automates logging in, tracks 14-day deadlines, and sends notifications. Also make sure that the language is bright and without dark patterns (for example, don’t hide the button on the third level of the menu).

Please note that the button is not a replacement for the return rules, but an additional feature that makes the process easier.

GPSR on product cards-safety and responsibility

from December 13, 2024, every consumer product in the PrestaShop store must meet the requirements of the GPSR (General Product Safety Regulation). And it’s not just about real security, it’s also about transparency – the customer needs to know who is responsible for what they buy. Information about so-called “economic operators” and an indication of the entity responsible for goods outside the community in the EU are becoming particularly relevant.

What information does the GPSR require

you to show in the product profile?:

• full name and contact details of the manufacturer (or importer, if the product is not part of the EU),
• indication of “EU responsible person”, i.e. responsible person in the Union for external goods,
• safety warnings (for example, age restrictions, risks of use),
• link or file with documentation: operating instructions, certificates of conformity, CE declarations (if applicable).

In practice, not all products require a complete set-clothing has different needs than toys or electronics. But if you are selling something more risky or for children, then it is better to have it on the last button.

Where and how to show them in PrestaShop

the simplest approach is an additional tab in the product tab (for example, “security and manufacturer”). Modules like GPSR Compliance Pro automate this process by adding dedicated fields. You can also use product attributes or custom fields in the description so that the information is visible before the purchase, and not somewhere in the store’s footer.

Special cases and exceptions

Goods produced and released to the market before 13.12.2024 can benefit from short transition periods, especially if they are old stocks. Industry differences (such as food and electronics) may require additional labeling. If you are not sure if your product meets the requirements, you should check the RAPEX EU database or ask a lawyer. This is no place for guesswork.

Availability of EAA-WCAG 2.1 AA software in the store

From 28 June 2025, online stores must meet the requirements of digital accessibility in accordance with the European Accessibility Act (Directive 2019/882). Microenterprises have an exception,but the rest? We must act. In practice, we are talking about compliance with WCAG 2.1 level AA and EN 301 549.

WCAG 2.1 AA: what it means for your store

the most important criteria that affect each PrestaShop:

• keyboard navigation -the entire store should work without a mouse, visible focus on links and buttons
• 4.5:1 contrast -text vs background, especially prices, error messages and
• calls to action Aria-labels – descriptions for shopping cart icons, search engine icons, mobile menu
• text alternatives -alt descriptions for product images (not “IMG_2847.jpg”)
• forms -clear labels, error messages related to fields, instructions before filling

in sound simple? Theoretically, yes. In practice, most PrestaShop templates have problems with keyboard focus in the menu, the contrast is random (especially in custom brand colors), and aria-labels simply don’t exist.

Why the WCAG module is not enough

There are several “accessibility modules” on the market – a widget with a color palette, text scaling, and high contrast mode. They look impressive in the demo. A problem? They don’t fix the HTML structure, don’t add aria-labels where they don’t exist, and don’t fix bad contrast in CSS. This is cosmetics.

True accessibility requires manual settings in the templates

.tpl, testing with screen readers (NVDA, JAWS) and auditing with En 301 549 in the background. A module can be an extension, but not a foundation.

Minimal process that makes sense

Start with an audit-automatic tools (WAVE, Axe DevTools) will catch ~30% of problems. You can find the rest by testing it using the keyboard and reader. Make the backlog correct by priority (critical: checkout and navigation, Bottom: blog and footer). Best of all, if you test with real users with disabilities. After deployment-monitoring, because every new module or change in the template can ruin availability.

Don’t wait until June. Audit + repair – this is 2-3 months of work, if the store is medium-sized.

Checkout without dark templates-compatible and converting

what to avoid: dark templates

Dark patterns, or dark patterns, are anything that deceitfully encourages the user to buy or hides the true cost. The most popular elimination tricks? Hidden delivery fees that appear only at the last stage, newsletter subscriptions or paid add-ons marked by default, false countdown (“only 3 minutes to complete the order!”), misleading discounts (“90% off!”where the price has never been higher). EU consumer law is clear: no gimmicks, full transparency from the start. And the customers? They feel it and just walk away.

Price Transparency and Omnibus

The Omnibus directive requires something simple: if you overestimate something, show the lowest price in the last 30 days. It sounds simple, but in practice, many sellers are still scheming. In PrestaShop, you can cover this with a module or customize the product map template. It is important to note that on checkout, show the full price: product, delivery, VAT (or OSS VAT for customers outside of Poland), possible additional fees. Everything is visible before you click “I buy and pay”. This isn’t just a legal requirement, it’s just fair game.

Order summary without pitfalls

The last screen before payment is the moment of truth. The client should see:

• full price broken down (groceries, shipping, taxes)
• clear CTA like “I order with a payment obligation”
• information about the right to withdraw (14 days)
• without hidden flags and surprises

technically? Use PrestaShop hooks (displayPaymentTop, displayBeforeCarrier) to insert legal messages where necessary, without cluttering up the layout. Checkout can be legal and convert at the same time, just don’t complicate things. Trust is growing, and profitability is decreasing.

Rules, policies, and permanent media

Let’s start with what “permanent storage” means in the context of an online store. It sounds high, but in practice we are talking about an email with a PDF attachment or with the full content of the rules in the message body. You send it to the client immediately after placing the order and again when they notify you of the termination of the contract. The directive requires the consumer to be able to save this information and return it to póżniej.

However, it must include the terms

of your privacy policy, terms of sale, and opt-out notice – this is not a decoration. There should be specific things:

• full identity of the seller (TIN, address, contact)
• Terms of delivery, shipping costs, lead time
• right of withdrawal (14 days) and exclusions
• complaint procedure, liability for defects
• Contact information for customer service

If you use multistore or have language versions, each must have consistent content. It can’t be that in the Polish version you write “7 days for refund”, and in the English version – “14 days”. This is a simple route to problems.

Content and link consistency

Make sure that links to the terms and conditions are visible in the footer and on the checkout page. Actually visible, not in the color # f4f4f4 on a white background. The content of the rules must match what you show in the cancel buttons module or in delivery time messages. The client reads “delivery 2-3 days”, and in the rules – “up to 10 business days”? Inconsistency in communication works to the detriment of the seller, especially when there is a dispute.

Some stores generate a PDF dynamically with each order, while others store a static file and update it once a quarter. Both approaches are fine as long as the client actually receives the current version to their email.

PrestaShop Modules and Architecture-Compliance Strategy

Since we are talking about compliance with EU legislation in PrestaShop, it should be understood that the platform itself is, in fact, Symfony with a layer of modules secured by hooks. And it’s these hooks that determine whether your store will be compatible or leaky like a sieve. Modules can be connected for checkout, customer account, product maps, even for generating PDF orders. Multistorage and multilingualism further complicate the situation, because each domain may have different legal requirements.

Hooks and integration points

the most important places to integrate compliance are

the displayHeader (this is where cookie scripts land), actionCustomerAccountAdd (consent during registration), displayProductAdditionalInfo (GPSR information on maps), and displayOrderConfirmation (withdrawal from the agreement). If the module doesn’t use the appropriate hooks or the theme doesn’t support them, you have a problem. This is why I always test staging before throwing anything into production.

Set of compliance modules

from practice, I recommend several types of modules that actually work:

• Official GDPR Compliance -the basis for processing GDPR requests, data export
• EU Cookie Law GDPR Blocker -blocks scripts until consent, supports Consent Mode V2
• GPSR Compliance Pro – adds fields of manufacturers, importers, responsible persons
• EU Right of Withdrawal Button -cancel button in the client’s account and in the confirmation
• modules for entering the action (who, when, what exported or deleted)

staging, versioning, and updates

No live updates. Version control (Git or similar), test environment, review, or a new module do not disable the theme. Then only production. And one more thing-compliance modules should generate logs (who exported data, when) and integrate with email as a permanent storage medium. The GDPR confirmation sent by email is your proof that you did everything correctly.

Audits, logs, and continuous compliance improvement

Legal compliance is not a one-time operation,but a process. You’ve implemented modules, set up a privacy policy, and, well, what’s next? The law changes, PrestaShop gets updates, new themes or add-ons appear. Without systematic checks, you run the risk that in six months something will stop working or a new recipe will surprise you.

Risk assessment and records

If you process sensitive data (such as corporate B2B accounts with health data in a supplement store) or work on a large scale, Dpia (Data Protection Impact Assessment) is no longer a pure theory. This is an assessment of where a leak or abuse might occur and what measures you plan to take. At the same time, keep records of processing operations: who processes the data, for what purpose, and how long it is stored. Does that sound bureaucratic? Yes, but the Uodo (Personal Data Protection Authority) can request this registry during verification.

Monitoring and compliance indicators

You need tangible metrics. SLA for GDPR requests (for example, exporting data in a maximum of 5 business days), logs of consent to cookies with timestamps, records of exporting and deleting user accounts. Set warnings: validation error in checkout (for example, there is no marketing consent, but the form passes), problems with WCAG (quarterly availability audit), drop in the number of accepted permissions (maybe modal cookies are poorly displayed?). Metrics show whether the system works, not just whether it theoretically exists.

The role of teams and reviews

Management sounds boring, but in practice it’s a matter of who is responsible for what. IT monitors modules and logs, the legal department monitors changes in rules and updates texts, and marketing manages newsletter subscriptions. Quarterly reviews: you check the changelog of modules, new versions of PrestaShop, if something has changed in the GDPR or GPSR. after each major update of the store, tests: If the registration form still registers permissions correctly, whether the “move away here”checkbox works. And the incident procedure: data leak? You have 72 hours to report to UODO. It’s best to have a plan in advance.

Costs, risks and schedule 2024-2026

Most store owners think of compliance as an additional cost. And technically, they are right, but looking solely through the prism of expenses is a mistake. You should also see the other side: what you risk by not implementing the changes, and when you should be ready.

How much GDPR fines cost (and how much non-compliance can cost)

is up to 20 million euros, or 4% of global annual turnover-whichever is higher. Does it sound abstract? Research shows that companies most vulnerable to GDPR requirements see sales decline by ~2% and profits by ~8%. This is not just a punishment, it is a loss of customer trust.

The implementations themselves look like this: cookies or GDPR modules cost from several hundred to several thousand zlotys, depending on the complexity. Legal and technical audit plus full compliance implementation? Here we are talking about several, sometimes tens of thousands. But (and this is important) investing in transparency increases conversions. Customers are more likely to buy where they feel safe.

Deadline dates

2024-2026 the regulation schedule looks specific:

your account is the first date behind, so if you’re selling physical products, quickly check to see if you have the details. The other two dates give you some more time, but deployments require testing.

Regulatory and reputational risks

in addition to finance, there is something less measurable: reputation. Checking UODO or being accused of dark patterns can be a media nightmare. Customers share such stories on social networks instantly. Compliance is also a competitive advantage because most of the market is constantly slow.

Compliance as an advantage-what remains after the deadline

Once you’ve completed all the necessary permissions, shortcuts, and legal references, you’ll be left with more than just ticks in the compliance list. In fact, you build trust that leads to real results. A store that immediately shows that it cares about the customer’s privacy and security simply looks more solid. People feel this even if they don’t read all the rules in full. And in a world where every second online store raises doubts about whether data is leaking somewhere or whether the product will arrive at all, this difference really matters.

PrestaShop gives you specific tools to handle all of this without hiring a full-time lawyer. Modules, forms, and ready-made templates. You can set this up once carefully and calmly. And here’s the thing: compliance with the law is not a constant stress, but an element of normal business conduct. Because deadliney will pass, the rules will probably still change, and you will already know how to figure it out.